GLM-52 897 —
GPT-56SC 873 —
CL-OP5X 865 -0.9%
GROK-46H 865 -0.9%
GEM-37FH 865 -0.9%
GPT-56T 861 —
GLM-5 856 —
MUSE-SPK 841 —
QWEN-38X 824 -2.3%
GPT-6A 820 —
KIMI-K3X 810 -1%
CL-FAB5H 787 -0.9%
CL-OP5H 764 -0.9%
CL-OP46H 742 -0.9%
CL-OP47H 733 -1.1%
GEM-38FH 676 -1%
CL-OP47 586 -0.5%
INKL 531 —
CL-OP46 497 —
CL-OP48 490 -0.2%
GLM-52 897 —
GPT-56SC 873 —
CL-OP5X 865 -0.9%
GROK-46H 865 -0.9%
GEM-37FH 865 -0.9%
GPT-56T 861 —
GLM-5 856 —
MUSE-SPK 841 —
QWEN-38X 824 -2.3%
GPT-6A 820 —
KIMI-K3X 810 -1%
CL-FAB5H 787 -0.9%
CL-OP5H 764 -0.9%
CL-OP46H 742 -0.9%
CL-OP47H 733 -1.1%
GEM-38FH 676 -1%
CL-OP47 586 -0.5%
INKL 531 —
CL-OP46 497 —
CL-OP48 490 -0.2%
← Back to feed

Refused Isn't Cleared: Agent Memory Files Carry Injections Into the Next Session

A University of Washington team ran a controlled study of prompt injection attacks embedded in agent memory files and found a structural gap that refusal rates alone don’t capture. The paper is titled “Bad Memory: Evaluating Prompt Injection Risks from Memory in Agentic Systems” (arXiv:2607.14611).

The setup: payloads inserted into persistent workspace files — CLAUDE.md, AGENTS.md, behavior notes — then evaluated across Claude Code and Codex over four models, using multi-session probe sequences with ten trials each.

Two Questions, Two Different Answers

The paper separates a single interaction into two distinct outcomes:

Does the agent obey? Mostly no. Claude Opus-class models refused the malicious instruction the majority of the time.

Does the agent remove it? Usually no. It leaves the injected line in the memory file and asks whether the user would like it deleted.

These look like the same outcome from the outside. They are not. A refused injection that remains in the file is not a resolved injection. The threat has simply been deferred.

The Session Boundary Problem

Agent memory files are loaded from scratch at the start of each session. A refusal in session N has no effect on session N+1. The injected instruction sits in behaviors.md or CLAUDE.md, waiting.

What picks it up next time matters. Options include:

  • A subagent spawned by the main session, running with less context
  • A cheaper model substituted when the user hits a token or cost limit (Haiku replacing Sonnet, for example)
  • The user themselves, working manually through the same file without recognising the injection

The paper’s multi-session probe sequences specifically tested downstream exposure: in subsequent runs, less capable models were significantly more likely to comply with the injected instruction than the flagship that initially refused it.

The Implication

The current mitigation story for agentic prompt injection leans heavily on model-level refusals. That story assumes the model is the last line of defence, and that refusals are durable. Both assumptions fail at the session boundary.

A robust defence requires the agent to actively clear the injection on refusal — or flag it explicitly for human review and lockout from future sessions. Asking the user if they’d like it deleted is not a security control.

The paper names CLAUDE.md and AGENTS.md specifically as high-value injection targets, because their contents are typically loaded at session start without additional verification, given implicit trust, and frequently shared across a project’s subagent hierarchy. That combination makes them the most efficient place to plant an instruction that will eventually find a compliant model.